Do I need a firewall, and if so, what kind?

A firewall is a critical component of keeping your machine safe on the internet. There are two basic types, but which is right for you?

//
I keep hearing about “firewalls” for my computer and that there are different types. Do I need one? If I do, what kind of firewall do I need?

The very short, very easy answer is: hell yes! Absolutely, positively you need a firewall.

With all that happens on the internet these days, it’s simply too risky to let your computer sit “naked” on the internet unless you really know what you’re doing. The real question is what kind of firewall do you need?

The very good news these days is that it’s very likely that you’re already behind a firewall and don’t need to do a thing.

But you should make sure.

What’s a firewall?

Let’s be clear: every computer should have or be behind a firewall. Possibly even both.

Firewalls are your first line of defense against an entire class of network-based threat that is constantly (yes, constantly) attempting to attack your computer. Those threats are stopped cold simply by having a firewall.

And there’s a good chance you already have one. Possibly even two.

In your car, a firewall is the “wall” of metal between you and the engine. Its purpose is to prevent engine fires from reaching you.

A firewall for your computer is much the same, except that the engine – the network you’re connected to – is always on fire. The point of a firewall is to keep you from getting burned.

Internet Safety

The Ask Leo! Guide to Staying Safe on the InternetThis article is an excerpt from The Ask Leo! Guide to Staying Safe on the Internet, full of more information about keeping yourself safe online.

Network-based threats

A firewall protects your computer from network-based threats.

Almost all computers on the internet are under constant attack. Malware on other machines, hackers, bot-nets, and more are waging a slow but extremely persistent war, probing the internet to find unprotected vulnerabilities on other internet-connected computers. If they find such a vulnerability, they infect the machine that they’ve found, or worse.

The basic concept of a firewall is very simple: it blocks or filters certain types of network traffic from ever reaching your computer.

Traffic that you want to reach your computer:

  • Websites pages that you visit
  • Software that you download
  • Music or videos that you might watch
  • And more…

Other traffic that you definitely don’t want:

  • Your neighbor’s machine, infected with a botnet, trying to connect to your machine over the network to spread the infection.
  • Overseas hackers trying to gain entry to your machine over the network to steal your personal information.
  • And more …

A firewall knows the difference.

Shielded RouterIf you look at the sets of examples above, they differ in one important aspect:

  • Things you want are connections that you or your computer initiate. On your order, your computer reaches out and asks for the webpages you visit, the software that you download or the music you might listen to.
  • Things that you don’t want are connections that are trying to come in from outside.

That’s an easy distinction for a firewall to make.

Two basic types of firewalls

Hardware firewalls

A router sitting between your computer and the internet is one of the best and most cost-effective firewalls that the average computer user can have. It’s usually a piece of equipment that sits physically between your computer and where the wires plug into the wall, with flashing lights that tell you it’s on duty.

The router’s job is to “route” data between the computer(s) and the internet.

Routers also allow you to share an internet connection by what’s called “Network Address Translation”. NAT “translates” between the single IP address you’ve been given by your internet service provider, and the IP addresses assigned to your machines by the router.

Routers watch for connections initiated by your computer reaching out to resources on the internet. When a connection is made, the router keeps track, so when a response comes back on that connection, it knows which of your local machines gets the data.

The side effect is that if an outside computer tries to start a connection, the router doesn’t know which computer to send it to. All it can do is ignore the attempt. That effectively blocks everything on the internet from trying to start a connection to a machine on your local network.

And that automatically makes your router a powerful incoming firewall.

Your router will not, however, filter outgoing traffic.

Software firewalls

Software firewalls are programs that run on your computer. They operate as close to the network interface as possible, and monitor all your network traffic.

If you’re not using a router, all of the network traffic will still technically reach your machine, but the firewall prevents malicious traffic from getting any further. Much like a router, a software firewall prevents the rest of your system from even realizing that there is any malicious traffic.

In addition, some software firewalls can be configured to monitor outgoing traffic. If your machine becomes infected and some malware attempts to “phone home” by connecting to a known malicious site, or tries to infect other machines on your network, a software firewall can warn you and block the attempt.

All current versions of Windows have a software firewall built in and turned on by default. Windows may even annoy you into ensuring that the firewall is either turned on (in Control Panel) or that you’re aware of the risks in not having it turned on.

The Windows firewall is primarily an incoming-only firewall.

Get More Answers!

Each week I publish The Ask Leo! Newsletter where you can find more answers tips and tricks to make your technology "just work"!

Subscribe NOW and get a FREE copy of my special report "10 Reasons Your Computer is Slow (and what to do about it)".

This report will help you identify exactly why your computer is slowing down and the steps you can take to fix it.



My Privacy Pledge

Choosing and setting up a firewall

In general, I recommend using a broadband router as your firewall. Since it’s very likely you already have one, that means you’re pretty much done.

There is disagreement. Some believe that an outgoing firewall is important. My position is that an outgoing firewall doesn’t really protect; it simply notifies after something bad has happened.

Routers are pretty common, and nearly a requirement for anyone who has more than one computer sharing an internet connection (though I’d recommend you use one even if you have only one computer). If you have a NAT router, you have a firewall without needing to burden each computer with additional software.

Software firewalls do make sense in a very important situation: they are critical when you can’t trust other computers on your local network.

Don’t trust the kids’ ability to keep their computer safe on the internet? Enable the software firewall on your computer.

Heading out to the local open WiFi hotspot? Turn on the software firewall before you connect.

In later versions of Windows, the built-in firewall has matured to the point where it’s actually quite reasonable to leave it on all the time, even if you’re behind a router. It seems to impact operations very little and saves you from remembering to turn it on when you travel or have that not-so-trustworthy guest on your network.

That’s why I said earlier that you might, in fact, have two firewalls already: your router and your Windows firewall. And that’s quite OK.

What firewalls can’t do

It’s important to remember that a firewall can’t protect you from everything.

A firewall protects you from threats that arrive via malicious connection attempts from elsewhere on the internet. A firewall will not protect you from things that you invite onto your machine yourself, such as email, attachments, downloads, and removable hard drives.

Nonetheless, protection from network attacks remains critically important.

This is a major update to an article originally posted : March, 2004
Play

Comments

  1. Jack

    Thanks Leo for your excellent site. I gain more here than many else.

    I am now using Linksys wireless-B Broadband router (same as yours) for my home network. My question is: Do I still need firewall in my computer in addition to the in-built firewall function of the router. The latter in my understanding is via NAT.

    Thanks a lot in advance.

  2. Leo

    Depends on what you’re doing, but in general, the answer’s no … the NAT firewall will do the trick.

    It does for me.

    Thanks!!

  3. Felix

    I’ve found that while my firewall is up, I cannot post to some forums, nor register with some sites (like my local newspaper classifieds.) Can I turn it off for these functions and still be relatively safe?

  4. Leo

    I’d find out what your firewall is blocking that’s preventing those things from working, and then adjusting it to allow what you need. How for both will vary depending on what firewall you’re using. Internet viruses can happen fairly quickly (people downloading patches have gotten reinfected faster than they can download), so I’m hesitant to recommend turning off the firewall completely.

  5. Melinda

    My computer has a firewall from Windows Service Pack 2 and virus protection. My question is I just purchased an internet system with 5 protection programs, which includes a firewall and antivirus protection, Do I need this in addition to what I already have? or is it unnecessary.

  6. Melinda

    My computer has a firewall from Windows Service Pack 2 and virus protection. My question is I just purchased an internet system with 5 protection programs, which includes a firewall and antivirus protection, Do I need this in addition to what I already have? or is it unnecessary.

  7. Shravanthi

    My computer has a Norton Personal Firewall installed. and the rediff bol application is not getting started because one of the ports is blocked because of the firewall. What do i do to make the application work without turning off the firewall.

  8. Carmelia

    Dear Leo;
    I am a soon to be foster parent of teen aged girls and I want to protect them from as many potential Internet related problems as possible, including chat rooms with unseemly types. What suggestions do you have for parents/foster parents with kids who want to use the Internet?
    Ann

  9. bob

    i just bought a new computer and when i went to the screen for my firewall, it was turned off. i turned it on and a friend told me i should turn it back off? what exactly is the firewall? i am not very smart when it comes to computers.

  10. Leo

    You do need a firewall of some sort, so ask your friend why he said not to. The article you just commented on outlines my suggestions.

  11. Suresh

    Hi Leo,

    I have Windows 200 professional and Mcafee viruscan 7.1 on my laptop.I have been having my dial-up connection from AOL for about 2 weeks.I did one mistake.I did not update my latest dat file from NAI.com for the viruscan.During that period some virus has entered my system and diabled my task manager.Later I updated teh latest dat file.But still I started getting messages from virscan that a virus file SVCHOST.exe could not be deleted fro c:winntsvchost.exe.Then I found this file in that location was just 1 week old.I also found one more file in location c:winntsystem32svchost.exe old dated and also smaller in size.Then c:winntsystem32svchost.exe to c:winntsvchost.exe.The viruscan report stopped coming but now this exe keeps executing itself from c:winntsvchost.exe on a empty command window and finally I have got a message on my desktop showing high risk of spyware and some problem on RAM.Please let me know what should I do.I have my Windows ME factory edition for my laptop.Should I go ahead and install the OS.If I take a backup of data on split drive D do I have a chance of getting viruses from the backup.

    Thanks,

    Chamu

  12. Faye

    I wanted to get back at my sister for sending me a lot of forwarded chain letters and other dumb stuff so I sent her a barrage of funny emails frm a certain site. It didn’t end up the way I had planned as she had just put in a firewall(called firefox) on her comp,she said she couldn’t access them,but one frm another site she could see. Why is that? Thanks for ur help!

  13. S. Naqvi

    We have AOL’s security system on our computer. My wife chose the computer check on AOL, and chose some option that keeps turning off our internet connection after a minute or so.

    We have a router that our computer connects to. It has an IP address that the fire wall seems to reject, but allows initially.

    If we go to Google, it allows us connection for a long time. But as soon as we try to go on Yahoo.com or msn.com or aol, then our internet connection gets interrupted. We have to disable and enable our connection again and again to connect for short periods of time.

    Please Help.

  14. brandy

    hey… i need a little help.. i cant seem to check my emails… i can get onto the hotmail.com website, and i can type in my email address and password.. but when i hit enter, it says page cannot be displayed. i personaly think that it is because of some kind of firewall. but i have no idea how to disable it. can you help me?

    can you IM me on aim at gummybear52291 please???

    thanks

  15. deepak

    our office having intranet so there is some sites are blocked so how to use rediffbol bypassing the proxy..kindly let me know

  16. Rln Zastovnik

    FIREWALL NOT NEEDED? Everyone says use a router/firewall when using DSL, cable, etc. I helped a friend with a new AT&T DSL account and insisted that he buy a router. So he purchased a Netgear router. During the setup, I was surprised to see that the modem was giving out a private 192.168.1.x address. Are they putting NAT firewalls in the modems now? None of the documentation mentioned that there was already a firewall. I installed the Netgear router anyway because I was not sure. Maybe he didn’t need to buy the router? I still can’t find any info about firewalls being included in DSL modems.
    -Ron

  17. Leo A. Notenboom

    —–BEGIN PGP SIGNED MESSAGE—–
    Hash: SHA1

    I have seen this, though as you’ve seen it;s hard to find
    documentation on it. The DSL modem at my wife’s business was
    handing out 192. addresses just as you describe. This does
    imply that it’s doing NAT, and does imply that it is acting,
    in some regard, as a firewall/router. And yes, that would be
    sufficient.

    And to clarify your lead-in statement, yes a firewall is
    still neccessary – it just might already be in your modem.

    Leo

    —–BEGIN PGP SIGNATURE—–
    Version: GnuPG v1.4.7 (MingW32)

    iD8DBQFHqfCTCMEe9B/8oqERAjlYAJ4+hsNrgAaELZ79CdeZc5Bol6NxVACgjpsi
    CMtarYfrjPu/oQ0SnBr0JLY=
    =9Rad
    —–END PGP SIGNATURE—–

  18. David Vogl

    Leo,
    Lately, according to Zone Alarm I have NUMEROUS programs all trying to contact 192.198.0.198 and .1 and 224.0.0.22 which appear to come from Africa! At your suggestion on the air I bought a D-Link DIR-655 router and NOD32 AV. I deleted ZA as I thought you said all I needed was the router. I’m really worried “something” is on my computer despite complete scans by NOD32 and several other on line scan programs. Should I go back and install Zone Alarm again?
    Am I in danger and should I worry?
    Thanks, Leo,
    David

  19. Ed

    I fix computers from time to time and I think some may have been hacked into. When I fix them I don’t use my router with a firewall I just connect via my modem and after there repaired I hook my router back up.
    So if the hacker can see my ip addy am I still safe since I put my router with firewall back up or should I use my router all the time even when I do repairs

  20. matt Falkenstein

    Ok, I now know hard/soft firewall, router, hub, switch. Question…. our previous computer technician set up a brand new dedicated server and connected the server > modem > broadband. (we have a dental office with much private info…. 17 computer stations) Currently all the protection we have that I know of is Norton Anitvirus and whatever our broadband has. A new computer tech says, “NOT EVEN ADEQUATE” and recommends a hardware device for max protection (about $500). What is right?

  21. Don Taber

    Agree with most of what you say in this article, but have a comment about the Comodo firewall. The Comodo firewall enjoys #1 ratings from many sources. I used it for several months, but ultimately uninstalled it. Why? It is annoyingly intrusive. It constantly pops up dialog boxes requiring you to allow or disallow one thing or other, even after going thru a long learning period. Its identification of what’s trying to get in is almost always cryptic — usually a file name that means nothing to me (and I help people fix software problems, so are pretty computer literate), and even less to most home computer users. I think it would be helpful to append the article to mention that Comodo is most useful for technically savvy users. Others will do just as well to use the free Windows firewall, even though it’s unidirectional.

  22. travel

    I have AOL and it does have its own firewall which I appreciate. Sometimes it does not allow me to go on a particular site, so I just use Firefox to get on. Not really a problem. I hope. Any concerns I should have?

  23. Charles Tilley

    I don’t see anything wrong with the one included with Windows 7. It’s adequate for my purposes. On XP Pro, the firewall was fine as well. As long as you play safe computing (no porn sites, not accepting every free download that comes your way to place spyware onto your computer), you should be safe. If the Windows default firewall was no good, they’d be advising to get one.

  24. James Nell

    Hi Leo
    Believe it or not , My pc got a perfect score in all areas at Gibson Research
    Happy new year for 2010
    :-)

    Color me impressed. Smile

    Leo
    30-Dec-2009

  25. Colin Sedgwick

    Hi All,
    A perfect score by Shields Up was achieved by Zone Alarm. You have complete control in and out. Free for private use. A little annoying but you are notified if programs change as well. Simple but effective. A firewall should never be turned off and a hardware and software firewall in tandem is the most secure. There is no conflict between the two. I have used a Router/software firewall combination with AVG on XP for years with no infections even on the most dangerous websites. Keep up the good work Leo.

  26. Brian

    If you don’t have file sharing turned on, and you know the things to avoid on internet such as popups, then I fail to see the justification for a firewall. This seems to me to be one of those forms of brainwashing that’s occured in the computer world where due to typical user stupidity, people are absolutely convinced that this is therefore their “internet condom”. Can you provide any more plausible/logical reason on *why* this is even helpful if you know your way around a pc backwards-and-forwards?

    There have been vulnerabilities – both as bugs and as configuration choices – in network-facing protocols other than file sharing that have allowed malware to infect a system not protected by a firewall – even for systems owned by people who claim to know their way around a computer backwards and forwards.

    Leo
    15-Jan-2010

  27. Jeff Hill

    First, there is never a good reason to NOT have a firewall! Just have a look at a typical log file to see the type and frequency of attacks that are being blocked, typically against ports for services you may not even know are running on your PC (this is where “shields UP” can help).

    Your consumer-grade router is probably adequate for home use, and as noted by others usually also provides a DHCP server. See if it has “stealth mode”, and if it does, be sure it’s turned on.

    If you have business assets to protect, however, a dedicated firewall appliance gives you more control, better logging and alerts, etc. I use a SonicWall TZ-100 on my server’s DSL, and a LinkSys router on my BrightHouse home network.

    Running a software firewall behind a hardware firewall probably won’t help you, and will probably degrade performance. Plus, if you’ve had to do any significant configuration for outbound services you’ll have to remember to make any changes to both firewalls.

    If you live behind a firewall don’t get complacent: be sure to turn the software firewall back on whenever you use a “Public” network (hotel, airport, etc.).

  28. R.

    The best free firewall programs that I’ve used are Comodo and Zone Alarm. Each has it’s pros and cons along with the learning curve for you and the software. I prefer Zone Alarm because I feel it’s a tad more user-friendly. To sum it up, if you’re a responsible surfer and you keep your system up to date then using either of these will just be some additional security.

    BTW, I’ve always recevied a perfect score from Gibson when I scanned my system.Either the test is missing something or my security is decent.

  29. Terri McNulty

    I scored perfect as well. I do not see the need for a software firewall and was quite pleased to find this article which makes the points that I have been telling people for a very long time. A router, for most people, will suffice. Thank you, Leo, for backing up those of us who tell others, “If you want your computer protected, put it behind a router.”

  30. Gwyn

    Is a BT Home Hub (which I have) the same as and/or as good as a router?

    I’m not famliar with the BT Home Hub, so you’ll need to check with the provider to see if it’s really a router. If it’s truly a “hub”, then no, it does not do what you need.

    Leo
    14-Dec-2011
  31. Gwyn

    Thanks Leo. I’ve just checked, and Wikipedia describe the BT Home Hub as a ” wireless residential gateway router”. I’ve also re-read your article about hubs, switches and routers, so I think it’s a bit odd that BT should describe it as a “hub”, when they could describe it, it seems, as a more powerful/secure “router”.

  32. Kay

    “The very short, very easy answer is: hell yes! Absolutely, positively you need a firewall.”

    Not applicable for for Linux based operating systems.

    • James B

      While I don’t know a lot about Linux, I suspect that you still need a firewall on a Linux machine. Hackers don’t really care what operating system you are using. They just want to attack your machine. I’m pretty sure somebody has tools out there that will hack into a Linux based computer.

      • Kay

        Hackers do care; They choose predominantly the most popular operating systems. As for viruses, the existing viruses which can modify Windows do not affect Linux in any way either. So, for Linux Distros/Operating Systems there is no need for a software firewall and anti-virus applications.
        Hint: Google can be your friend.

        • The only system I’ve ever had compromised by a hacker … was a Linux based server. A firewall (among other things) would have helped.

    • We disagree. One of the first things I set up on my Linux boxen is a firewall. In fact, to be honest, the typically included Linux firewall is one of the best.

  33. Noah

    Is just a software firewall okay? I have Norton Security Suite’s firewall. I’m not sure I want to buy a router just for the firewall…

  34. Chris

    Leo,
    Will my best bet to be safe from any prying eyes be to create VM or virtual pc box for each individual activity for example : Vitural box for browsing, virtual box for business connections and emailing, virtual box for emailing and browsing for personal use besides business then back up all these on CDs and Macrium.

    I am currently on Windows 7 and would like to create windows 7 VM or vitrual pc box machines within windows 7.
    I am currently on a century link router and would like to know how I can get another personal firewall from anything that may get through Century link router.

    Im looking to set up VPN within the virtual PC box machines and have
    encrypted email service along with harddrive
    for maximum protection. Any guidance would be massively appreciated.

Leave a reply:

Before commenting please:

  • Read the article. Seriously. You'd be shocked at how many people make comments that prove they didn't.
  • Comment only on the article. If you have a new, unrelated question start with the search box at the top of the page.
  • Don't post personal information. Email addresses, phone numbers and such will be removed.

VERY IMPORTANT: because of a rise in comment spam that's making it through our filters any comments that do not add to the discussion - typically off topic or content-free comments - run a very high risk of being flagged as spam and removed.

If you have a new question unrelated to the article above, ask it on the Ask Leo! ask-a-question page.

Your email address will not be published. Required fields are marked *